{"Event": {"info": "M2M -  GlobeImposter \"..doc\" 2017-12-27 :\n \"Invoice_1234567\" - \"Invoice_1234567.7z\"", "Tag": [{"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\""}], "publish_timestamp": "0", "timestamp": "1515013150", "Object": [{"comment": "", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "3ed85207-b157-4745-a30d-223cae8e8d74", "sharing_group_id": "0", "timestamp": "1515013142", "description": "File object describing a file with meta-information", "template_version": "7", "ObjectReference": [{"comment": "", "object_uuid": "3ed85207-b157-4745-a30d-223cae8e8d74", "uuid": "5a4d4414-3bac-498f-8b61-dbef02de0b81", "timestamp": "1515013140", "referenced_uuid": "15df077e-da4b-4e48-9796-be4f4d43c3c2", "relationship_type": "analysed-with"}], "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5a4d4413-3e7c-4b1f-b366-dbef02de0b81", "timestamp": "1515013139", "to_ids": true, "value": "88892bc44277214a8c664dafac4de77b5eb480dd", "disable_correlation": false, "object_relation": "sha1", "type": "sha1"}, {"comment": "", "category": "Payload delivery", "uuid": "5a4d4413-e5d8-401e-94c7-dbef02de0b81", "timestamp": "1515013139", "to_ids": true, "value": "0780c1594f308101ab5a30baac2f3402", "disable_correlation": false, "object_relation": "md5", "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5a4d4413-ea3c-42c3-8d4e-dbef02de0b81", "timestamp": "1515013139", "to_ids": true, "value": "249594d4bce1741ced9fa4396111afcd0c87e1a606dbf5b6d276294bb07ddeec", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": "", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "uuid": "15df077e-da4b-4e48-9796-be4f4d43c3c2", "sharing_group_id": "0", "timestamp": "1515013139", "description": "VirusTotal report", "template_version": "1", "Attribute": [{"comment": "", "category": "External analysis", "uuid": "5a4d4413-9160-4be4-a1da-dbef02de0b81", "timestamp": "1515013139", "to_ids": false, "value": "https://www.virustotal.com/file/249594d4bce1741ced9fa4396111afcd0c87e1a606dbf5b6d276294bb07ddeec/analysis/1514726816/", "disable_correlation": false, "object_relation": "permalink", "type": "link"}, {"comment": "", "category": "Other", "uuid": "5a4d4413-4958-4c24-848a-dbef02de0b81", "timestamp": "1515013139", "to_ids": false, "value": "46/67", "disable_correlation": true, "object_relation": "detection-ratio", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5a4d4413-ecc4-4f16-b5fd-dbef02de0b81", "timestamp": "1515013139", "to_ids": false, "value": "2017-12-31 13:26:56", "disable_correlation": false, "object_relation": "last-submission", "type": "datetime"}], "distribution": "5", "meta-category": "misc", "name": "virustotal-report"}], "analysis": "1", "Attribute": [{"comment": "www.smartwashingtonhomebuyers.com", "category": "Network activity", "uuid": "5a4c9331-5f8c-4dd4-8ab7-4b1a950d210f", "timestamp": "1515013138", "to_ids": false, "value": "199.188.200.143", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a4c932f-963c-483b-ac63-4b86950d210f", "timestamp": "1515013138", "to_ids": true, "value": "www.smartwashingtonhomebuyers.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "www.seoforecommerce.org", "category": "Network activity", "uuid": "5a4c932d-e4bc-4b75-b769-44d4950d210f", "timestamp": "1515013138", "to_ids": false, "value": "199.188.200.140", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "www.richardwillettphotography.com", "category": "Network activity", "uuid": "5a4c932a-a9f8-44b1-b61b-4461950d210f", "timestamp": "1515013138", "to_ids": false, "value": "184.168.131.233", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a4c9328-4ee4-4892-ad9b-4bef950d210f", "timestamp": "1515013138", "to_ids": true, "value": "www.richardwillettphotography.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "www.ekremmutlu.com", "category": "Network activity", "uuid": "5a4c9326-7da8-4c6a-b1a1-4bd3950d210f", "timestamp": "1515013138", "to_ids": false, "value": "109.230.196.225", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a4c9325-aecc-47ee-ba83-47f4950d210f", "timestamp": "1515013138", "to_ids": true, "value": "www.ekremmutlu.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "www.almarjantobacco.com", "category": "Network activity", "uuid": "5a4c9321-ea20-4c44-8888-42cd950d210f", "timestamp": "1515013138", "to_ids": false, "value": "41.185.8.111", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "www.agenterbaik88.com", "category": "Network activity", "uuid": "5a4c931c-0424-44b6-afce-4e49950d210f", "timestamp": "1515013138", "to_ids": false, "value": "154.16.244.20", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Payload delivery", "uuid": "5a4c9318-ca44-4f14-b60a-4311950d210f", "timestamp": "1514967832", "to_ids": true, "value": "0780c1594f308101ab5a30baac2f3402", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "5a4c931b-f184-42e8-8475-4bf4950d210f", "timestamp": "1515013138", "to_ids": true, "value": "www.agenterbaik88.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "", "category": "Network activity", "uuid": "5a4c9333-4378-41b1-ba32-4f15950d210f", "timestamp": "1515013138", "to_ids": true, "value": "www.webseorank.org", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "", "category": "Network activity", "uuid": "5a4c9336-5084-446c-b883-46b3950d210f", "timestamp": "1515013138", "to_ids": true, "value": "https://topyzscsu5poprxy.onion.link/shfgealjh.php", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a4c9337-564c-493a-81e2-480b950d210f", "timestamp": "1515013138", "to_ids": true, "value": "topyzscsu5poprxy.onion.link", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "topyzscsu5poprxy.onion.link", "category": "Network activity", "uuid": "5a4c9339-a684-471a-ad45-4c94950d210f", "timestamp": "1515013138", "to_ids": false, "value": "103.198.0.2", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a4c933b-a114-4fcf-90c9-4c4b950d210f", "timestamp": "1515013139", "to_ids": true, "value": "http://psoeiras.net/js/count.php?nu=105&fb=110", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a4c933d-8568-4a46-9e14-423b950d210f", "timestamp": "1515013139", "to_ids": true, "value": "psoeiras.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "psoeiras.net", "category": "Network activity", "uuid": "5a4c933f-f68c-4bbe-8bc2-4611950d210f", "timestamp": "1515013139", "to_ids": false, "value": "74.220.219.67", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}], "extends_uuid": "", "published": false, "date": "2018-01-03", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5a4c9317-4304-4cbf-877d-4680950d210f"}}